CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved:

spi: spi-qpic-snand: write the feature value before executing SET_FEATURE

qcomspisendcmdaddr() programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For SPINANDSETFEATURE the value to be written is only placed into NANDFLASHFEATURES afterwards, by qcomspiioop(), in a second submission - so the chip is programmed with whatever that register happened to hold from a previous operation, and the intended value is only applied by the next SET_FEATURE.

Measured on a TP-Link Archer AX55 v1 (IPQ5018, ESMT F50L1G41LB): writing 0x40 to the configuration register (0xb0) leaves the chip at 0x00, and the subsequent write of 0x00 leaves it at 0x40 - every write lands one operation late.

This stayed unnoticed until v6.18 added SPI-NAND OTP support together with OTP entries for ESMT chips. spinandotprw() enables OTP mode, reads, and disables it again, and mtdotpnvmemadd() does this during MTD registration. With the off-by-one, the "disable" write actually applies the previously requested value, so CFGOTP_ENABLE ends up set: the chip stays in OTP mode, every subsequent array read returns the OTP area instead of the array (UBI reports an empty device) and all writes fail with -EIO because the OTP area is write protected. On this board that makes the whole flash unusable and the device unbootable.

Write the feature value into NANDFLASHFEATURES as part of the same transaction, before NANDEXECCMD. While at it, copy only the bytes the operation actually carries - the previous code dereferenced a 4-byte pointer on a one-byte buffer (spinand->scratchbuf).

With this patch the flash contents read back bit-identical to a known-good dump of the same board taken under the vendor firmware (md5-verified across partitions), and writes work.